WordPress on Docker, with phpMyAdmin, SSL (via Traefik) and automatic updates

#!/bin/sh
export DEBIAN_FRONTEND=noninteractive

# Wait for apt-get to be available.
while ! apt-get -qq check; do sleep 1s; done

# Install docker-ce and docker-compose.
apt-get update
apt-get install -y apt-transport-https ca-certificates curl gnupg2 software-properties-common
curl -fsSL https://download.docker.com/linux/debian/gpg | apt-key add -
add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/debian `lsb_release -cs` stable"
apt-get update
apt-get install -y docker-ce
curl -fsSL https://github.com/docker/compose/releases/download/1.21.2/docker-compose-`uname -s`-`uname -m` -o /usr/local/bin/docker-compose
chmod +x /usr/local/bin/docker-compose

# Check for security updates every night and install them.
apt-get install -y unattended-upgrades

# Retrieve configuration files. Lots of explanatory comments inside!
# If you'd rather inspect and install these files yourself, see:
# https://docs.bytemark.co.uk/article/wordpress-on-docker-with-phpmyadmin-ssl-via-traefik-and-automatic-updates/#look-a-bit-deeper
mkdir -p /root/compose
curl -fsSL https://raw.githubusercontent.com/BytemarkHosting/configs-wordpress-docker/master/docker-compose.yml -o /root/compose/docker-compose.yml
curl -fsSL https://raw.githubusercontent.com/BytemarkHosting/configs-wordpress-docker/master/.env -o /root/compose/.env
curl -fsSL https://raw.githubusercontent.com/BytemarkHosting/configs-wordpress-docker/master/traefik.toml -o /root/compose/traefik.toml
curl -fsSL https://raw.githubusercontent.com/BytemarkHosting/configs-wordpress-docker/master/php.ini -o /root/compose/php.ini

# Traefik needs a file to store SSL/TLS keys and certificates.
touch /root/compose/acme.json
chmod 0600 /root/compose/acme.json

# Use the hostname of the server as the main domain.
sed -i -e "s|^TRAEFIK_DOMAINS=.*|TRAEFIK_DOMAINS=`hostname -f`|" /root/compose/.env
sed -i -e "s|^WORDPRESS_DOMAINS=.*|WORDPRESS_DOMAINS=`hostname -f`|" /root/compose/.env

# Fill /root/compose/.env with some randomly generated passwords.
sed -i -e "s|^WORDPRESS_DB_ROOT_PASSWORD=.*|WORDPRESS_DB_ROOT_PASSWORD=`cat /dev/urandom | tr -dc '[:alnum:]' | head -c14`|" /root/compose/.env
sed -i -e "s|^WORDPRESS_DB_PASSWORD=.*|WORDPRESS_DB_PASSWORD=`cat /dev/urandom | tr -dc '[:alnum:]' | head -c14`|" /root/compose/.env
apt-get install -y apache2-utils
BASIC_AUTH_PASSWORD="`cat /dev/urandom | tr -dc '[:alnum:]' | head -c10`"
BASIC_AUTH="`printf '%s\n' "$BASIC_AUTH_PASSWORD" | tee /root/compose/auth-password.txt | htpasswd -in admin`"
sed -i -e "s|^BASIC_AUTH=.*|BASIC_AUTH=$BASIC_AUTH|" /root/compose/.env

# Start our containers.
cd /root/compose
docker-compose up -d

apt-get update
apt-get install -y apt-transport-https ca-certificates curl gnupg2 software-properties-common
curl -fsSL https://download.docker.com/linux/debian/gpg | apt-key add -
add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/debian `lsb_release -cs` stable"
apt-get update
apt-get install -y docker-ce
curl -fsSL https://github.com/docker/compose/releases/download/1.21.2/docker-compose-`uname -s`-`uname -m` -o /usr/local/bin/docker-compose
chmod +x /usr/local/bin/docker-compose

version: '3'
# See https://docs.docker.com/compose/overview/ for more information.

# If you make changes to this file or any related files, apply them by
# navigating to the directory that holds this file and run this as root:
#   docker-compose down; docker-compose up -d

# Create two networks: one for front-end containers that we'll make
# publicly accessible to the internet, and one for private back-end.
networks:
  frontend:
  backend:

# Create persistent Docker volumes to preserve important data.
# We don't want our data to be lost when restarting containers.
volumes:
  vol-wp-db:
  vol-wp-content:

# Create our containers.
services:
  # Traefik is a reverse proxy. It handles SSL and passes traffic to
  # Docker containers via rules you define in docker-compose labels.
  # Its dashboard is at http://example.com/traefik/ (behind a login).
  traefik:
    # https://hub.docker.com/_/traefik/
    image: traefik:latest
    command: --api --docker --acme.email="${ACME_EMAIL}"
    restart: always
    networks:
      - backend
      - frontend
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock # Access to Docker
      - ./traefik.toml:/traefik.toml              # Traefik configuration
      - ./acme.json:/acme.json                    # SSL certificates
    ports:
      # Map port 80 and 443 on the host to this container.
      - "80:80"
      - "443:443"
    labels:
      - "traefik.docker.network=frontend"
      - "traefik.enable=true"
      - "traefik.frontend.rule=Host:${TRAEFIK_DOMAINS}; PathPrefixStrip:/traefik"
      - "traefik.port=8080"
      - "traefik.protocol=http"
      # Remove next line to disable login prompt for the dashboard.
      - "traefik.frontend.auth.basic=${BASIC_AUTH}"

  # Watchtower detects if any linked containers have an new image
  # available, automatically updating & restarting them if needed.
  watchtower:
    # https://hub.docker.com/r/centurylink/watchtower/
    image: v2tec/watchtower:latest
    # https://github.com/v2tec/watchtower#options
    # This schedule applies updates (if available) at midnight.
    command: --cleanup --schedule "0 0 0 * * *"
    restart: always
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    labels:
      - "traefik.enable=false"

  wp-db:
    # https://hub.docker.com/_/mariadb/
    # Specify 10.3 as we only want watchtower to apply minor updates
    # (eg, 10.3.1) and not major updates (eg, 10.4).
    image: mariadb:10.3
    restart: always
    networks:
      - backend
    volumes:
      # Ensure the database persists between restarts.
      - vol-wp-db:/var/lib/mysql
    environment:
      MYSQL_ROOT_PASSWORD: ${WORDPRESS_DB_ROOT_PASSWORD}
      MYSQL_DATABASE: ${WORDPRESS_DB_NAME}
      MYSQL_USER: ${WORDPRESS_DB_USER}
      MYSQL_PASSWORD: ${WORDPRESS_DB_PASSWORD}
    labels:
      - "traefik.enable=false"

  # The main front-end application.
  wp:
    # https://hub.docker.com/_/wordpress/
    # Replace "latest" with "4.9" to stick to a specific version.
    image: wordpress:latest
    depends_on:
      - wp-db
    restart: always
    networks:
      - backend
      - frontend
    volumes:
      # Ensure WP themes/plugins/uploads persist between restarts.
      - vol-wp-content:/var/www/html/wp-content
      # Install our own php.ini, which can be customized.
      - ./php.ini:/usr/local/etc/php/php.ini
    environment:
      WORDPRESS_DB_HOST: wp-db:3306
      WORDPRESS_DB_NAME: ${WORDPRESS_DB_NAME}
      WORDPRESS_DB_USER: ${WORDPRESS_DB_USER}
      WORDPRESS_DB_PASSWORD: ${WORDPRESS_DB_PASSWORD}
    labels:
      - "traefik.docker.network=frontend"
      - "traefik.enable=true"
      - "traefik.frontend.rule=Host:${WORDPRESS_DOMAINS}"
      - "traefik.port=80"
      - "traefik.protocol=http"

  # Navigate to http://example.com/phpmyadmin/ to manage your MySQL
  # databases. (Don't forget the last forward slash.) Like the Traefik
  # dashboard, this is behind a login prompt to help you stay secure.
  wp-phpmyadmin:
    # https://hub.docker.com/r/phpmyadmin/phpmyadmin/
    image: phpmyadmin/phpmyadmin:latest
    depends_on:
      - wp-db
    restart: always
    networks:
      - backend
      - frontend
    volumes:
      # Install our own php.ini, which can be customized.
      - ./php.ini:/usr/local/etc/php/php.ini
    environment:
      PMA_HOST: wp-db
      PMA_ABSOLUTE_URI: /phpmyadmin/
      MYSQL_ROOT_PASSWORD: ${WORDPRESS_DB_ROOT_PASSWORD}
    labels:
      - "traefik.docker.network=frontend"
      - "traefik.enable=true"
      - "traefik.frontend.rule=Host:${WORDPRESS_DOMAINS}; PathPrefixStrip:/phpmyadmin/"
      - "traefik.port=80"
      - "traefik.protocol=http"
      # Remove the next line if you don't want a browser login prompt.
      - "traefik.frontend.auth.basic=${BASIC_AUTH}"

  # This allows WordPress to send email straight out of the box without
  # having to rely on an external provider like SendGrid or MailGun.
  # It makes an SMTP host available at the hostname "mail".
  mail:
    image: bytemark/smtp
    restart: always
    networks:
      - frontend
    labels:
      - "traefik.enable=false"

# Docker Compose can read environment variables from this file.
# See https://docs.docker.com/compose/env-file/

# Put admin areas behind a login prompt, with username and password
# specified here. Run `htpasswd -n admin` to create a password for
# user "admin" and paste the output here. SSL strongly recommended.
BASIC_AUTH=

# Let's Encrypt needs an email address for registration.
ACME_EMAIL=

# The Traefik dashboard will be available at these domains.
# The URL is http://example.com/traefik/
TRAEFIK_DOMAINS=example.com,www.example.com

# Your WP site will be available at these domains. If all domains
# have DNS records pointing to your server, they'll get SSL certs.
WORDPRESS_DOMAINS=example.com,www.example.com

# Set a secure password for the MySQL root user. Remember this so
# you can login to phpMyAdmin (as username "root").
WORDPRESS_DB_ROOT_PASSWORD=

# Set the MySQL database name, user and password for WordPress.
WORDPRESS_DB_NAME=wordpress
WORDPRESS_DB_USER=wordpress
WORDPRESS_DB_PASSWORD=

sed -i -e "s|^TRAEFIK_DOMAINS=.*|TRAEFIK_DOMAINS=`hostname -f`|" /root/compose/.env
sed -i -e "s|^WORDPRESS_DOMAINS=.*|WORDPRESS_DOMAINS=`hostname -f`|" /root/compose/.env
sed -i -e "s|^WORDPRESS_DB_ROOT_PASSWORD=.*|WORDPRESS_DB_ROOT_PASSWORD=`cat /dev/urandom | tr -dc '[:alnum:]' | head -c14`|" /root/compose/.env
sed -i -e "s|^WORDPRESS_DB_PASSWORD=.*|WORDPRESS_DB_PASSWORD=`cat /dev/urandom | tr -dc '[:alnum:]' | head -c14`|" /root/compose/.env
apt-get install -y apache2-utils
BASIC_AUTH_PASSWORD="`cat /dev/urandom | tr -dc '[:alnum:]' | head -c10`"
BASIC_AUTH="`printf '%s\n' "$BASIC_AUTH_PASSWORD" | tee /root/compose/auth-password.txt | htpasswd -in admin`"
sed -i -e "s|^BASIC_AUTH=.*|BASIC_AUTH=$BASIC_AUTH|" /root/compose/.env

# Traefik will listen for traffic on both HTTP and HTTPS.
defaultEntryPoints = ["http", "https"]

# Network traffic will be entering our Docker network on the usual web ports
# (ie, 80 and 443), where Traefik will be listening.
[entryPoints]
  [entryPoints.http]
  address = ":80"
  # Comment out the following two lines to redirect HTTP to HTTPS.
  #  [entryPoints.http.redirect]
  #  entryPoint = "https"
  [entryPoints.https]
  address = ":443"
    [entryPoints.https.tls]

# These options are for Traefik's integration with Docker.
[docker]
endpoint = "unix:///var/run/docker.sock"
domain = "docker.localhost"
watch = true
exposedByDefault = false

# These options are for Traefik's integration with Let's Encrypt.
# Your certificates are stored inside /acme.json inside the container,
# which is /root/compose/acme.json on your server.
[acme]
storage = "acme.json"
onHostRule = true
entryPoint = "https"
  [acme.httpChallenge]
  entryPoint = "http"

# https://docs.traefik.io/configuration/logs/
# Comment out the next line to enable Traefik's access logs.
# [accessLog]

# Feel free to add and change any settings you want in here.
upload_max_filesize = 128M
post_max_size = 128M
max_execution_time = 180
memory_limit = 256M